hxxps://raw[.]githubusercontent[.]com/gelabagbaia-Orders/Factua-Invoici/refs/heads/Factua-Invoici_pages/Factua%20Invoici[.]rar

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/09/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://raw.githubusercontent.com/gelabagbaia-Orders/Factua-Invoici/refs/heads/Factua-Invoici_pages/Factua%20Invoici.rar
Sample260923-1emdhsdf53

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
15	raw.githubusercontent.com
20	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346728388666795"	msedge.exe

Modifies registry class 58 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{B110ACF9-4A1C-43E7-8F7A-4598B246167B}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000025da91eefe41dd01e8fa5fc40742dd01958cf448a34bdd0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5700	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2636	4784	msedge.exe	87
PID 4784 wrote to memory of 4152	4784	msedge.exe	88
PID 4784 wrote to memory of 4340	4784	msedge.exe	89
PID 4784 wrote to memory of 4340	4784	msedge.exe	89
PID 4784 wrote to memory of 4340	4784	msedge.exe	89
PID 4784 wrote to memory of 4440	4784	msedge.exe	90
PID 4784 wrote to memory of 4440	4784	msedge.exe	90
PID 4784 wrote to memory of 2948	4784	msedge.exe	92
PID 4784 wrote to memory of 2948	4784	msedge.exe	92
PID 4784 wrote to memory of 2948	4784	msedge.exe	92
PID 4784 wrote to memory of 2124	4784	msedge.exe	93
PID 4784 wrote to memory of 2124	4784	msedge.exe	93
PID 4784 wrote to memory of 2124	4784	msedge.exe	93
PID 4784 wrote to memory of 2608	4784	msedge.exe	94
PID 4784 wrote to memory of 2608	4784	msedge.exe	94
PID 4784 wrote to memory of 2608	4784	msedge.exe	94
PID 4784 wrote to memory of 3320	4784	msedge.exe	95
PID 4784 wrote to memory of 3320	4784	msedge.exe	95
PID 4784 wrote to memory of 3320	4784	msedge.exe	95
PID 4784 wrote to memory of 2596	4784	msedge.exe	99
PID 4784 wrote to memory of 2596	4784	msedge.exe	99
PID 4784 wrote to memory of 2916	4784	msedge.exe	100
PID 4784 wrote to memory of 2916	4784	msedge.exe	100
PID 4784 wrote to memory of 3292	4784	msedge.exe	102
PID 4784 wrote to memory of 3292	4784	msedge.exe	102
PID 4784 wrote to memory of 3292	4784	msedge.exe	102
PID 4784 wrote to memory of 3704	4784	msedge.exe	101
PID 4784 wrote to memory of 3704	4784	msedge.exe	101
PID 4784 wrote to memory of 5112	4784	msedge.exe	103
PID 4784 wrote to memory of 2976	4784	msedge.exe	107
PID 4784 wrote to memory of 5144	4784	msedge.exe	114
PID 4784 wrote to memory of 5144	4784	msedge.exe	114
PID 4784 wrote to memory of 5144	4784	msedge.exe	114
PID 4784 wrote to memory of 5644	4784	msedge.exe	116
PID 4784 wrote to memory of 5644	4784	msedge.exe	116
PID 4784 wrote to memory of 5944	4784	msedge.exe	117
PID 4784 wrote to memory of 5944	4784	msedge.exe	117
PID 4784 wrote to memory of 5944	4784	msedge.exe	117
PID 4784 wrote to memory of 5568	4784	msedge.exe	119
PID 4784 wrote to memory of 5568	4784	msedge.exe	119
PID 4784 wrote to memory of 5568	4784	msedge.exe	119
PID 4784 wrote to memory of 5656	4784	msedge.exe	120
PID 4784 wrote to memory of 5656	4784	msedge.exe	120
PID 4784 wrote to memory of 5656	4784	msedge.exe	120
PID 4784 wrote to memory of 5824	4784	msedge.exe	121
PID 4784 wrote to memory of 5824	4784	msedge.exe	121
PID 4784 wrote to memory of 5824	4784	msedge.exe	121
PID 4784 wrote to memory of 5304	4784	msedge.exe	123
PID 4784 wrote to memory of 5304	4784	msedge.exe	123
PID 4784 wrote to memory of 5304	4784	msedge.exe	123
PID 4784 wrote to memory of 5700	4784	msedge.exe	124
PID 4784 wrote to memory of 5476	4784	msedge.exe	127
PID 4784 wrote to memory of 5480	4784	msedge.exe	128
PID 4784 wrote to memory of 5484	4784	msedge.exe	129
PID 4784 wrote to memory of 6008	4784	msedge.exe	136
PID 4784 wrote to memory of 6008	4784	msedge.exe	136
PID 4784 wrote to memory of 5840	4784	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://raw.githubusercontent.com/gelabagbaia-Orders/Factua-Invoici/refs/heads/Factua-Invoici_pages/Factua%20Invoici.rar
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff8c562c188,0x7ff8c562c194,0x7ff8c562c1a0
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,15215266912009894580,16241511348063762738,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4277121724609410190,7118601363040639184,262144 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,3849390254904633749,1721789797169986931,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,7718833570967561775,9961681375662760851,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,1473216191640178583,360361020916051390,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,16518860073783825415,373847371122921277,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,14094092999539764871,14949797987565424828,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15756653349019424261,11162653552445809854,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10744306306852171078,13797064664681435360,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,7788998252981730793,14017879595375452022,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5676,i,1924645066671174237,10912893006133597442,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,3837902702298172120,6179335816273181520,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,5107851114643374886,348157130222324050,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,5107851114643374886,348157130222324050,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4348,i,9827871416267893295,4638872150376368070,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,1539868866645048809,2449764746548377402,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7160,i,3365899228429055838,9063982751308061487,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7288,i,9005306938880300602,88581363161520166,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7536,i,12949016171656431735,4356425010891345519,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6512,i,7602979092989639699,10235341079926344222,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3436,i,9434916002752595685,7181509833341777082,2097152 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,17115040771070619374,2512331740193495748,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,3962258279136621741,16367774942006240894,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,5024712909368956344,4162257307805453480,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,4377852438170444277,13706327313582729191,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,12099657512001695382,10951066163885252293,524288 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6752,i,8511686450116978391,1898991241006076571,262144 --field-trial-handle=2456,i,12812507335777173434,11009991374289610485,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 416KB
SHA256 5f62c06ab96d152f50b60e85613ae5f1a22dda4ab3f68fc5e714c3199cace43d
MD5 706d85137cd327f97514918d26c2272f
SHA1 acf5f86aa6631b06cbfb2df6391ba80355a0590f
SHA512 0b6e73572002a591215bd8c2e2c30bf42ad6ab332f5124205dac99c91a94ca9c668f75e4ad44e6e6bb4ed9101ae861c34fc8977f328cb167f3e91dbffcb0b0a8
SSDEEP 6144:Iipk7kvK3xciJIDI3IXCZfqU5YWhVxd/rUgnBPVjf69VvozHZA61TQnHMLwk3AW2:FkuIcFI3SQqUdDUgnBBoAtTQnsLwagFn
TLSH
T15C9423284D3A7B2413B2C67727035FB4493CA87B99D51049FA742BB59ACF2160066DFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 69KB
SHA256 6b11e04ce4a642e80e9ff1f060410d1876ad0c55fe1c19a145bee83d5986138d
MD5 43b0c61c9cde4eb4029912a73ce7c069
SHA1 d428227a7e9a2d4d0a7e6b6a760b007cd65f6859
SHA512 480783f8d97f3925154c78fc672d2c5db559cb3fad0fc22f74fdbf549d717afe7588011f4c88d9fa4fdbda6a5da172c95e7299bd1197ea1bdaf7646da2151265
SSDEEP 1536:jirSP8Y2YSoz/Ek2Im6srlbA5TTHUKDxYhlfBNJgQGpOmkvhSeXO35viSLg:jirSPOP2/DK6kRmLxzj181XOzLg
TLSH
T157630249C25A5FF88C14D95ABB14B81104C34577A72AFF462E28DA7082FDF4ED180EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 38KB
SHA256 a80ef4f7a78ec326368059208e9fa5e6e095631d94bc839906cdd6a00af3d4fb
MD5 b70c815ce95f3bb5a2fff73574ddd722
SHA1 fe6ddff41cd3c782e7272584114ede523fb05fe8
SHA512 4feeac53a656388e7d384cc85cc304644749b014095b311d66fced2aaee42a2c151c625147dcb34f5308e3ba4f05c70bd3a5dd168d82d5d5af798caf9a62298c
SSDEEP 768:3p4OVtavsULOFWv1QTKcQePnWWmnKIhwerPS3MXeLkfv5Lu8kmC:3XXZIv1QFPnWZn7EMXekuBx
TLSH
T1CB03F20A3D6B40109572C0AF716A1723E1DC2AD37245E947A5D1B672D3B4B34BB4BCCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 80b001fdc0112c2f99440c01fe9daaee60ed2574a3fa781f35cfaceafff90833
MD5 657d42f6da3eba3e316a74dc4184cbe8
SHA1 79f295a32ccd93e097085386392a86905dca3515
SHA512 b1b86647c9aaac7cc0a86c468b7286d91109ac243631deb7e1b64b6e31950e7254faf6e09740bc9f42e5e2509df208f4fbc49adffd67869113c28b54e0a0575e
SSDEEP 96:9eiD+HaXOpzGT2K1BUIfk6CzSdYe6lCRhaPS1IV+DrTbOxbdy7zjCgt1GjFV:t+HrCyK1BUg9l56UQIf/OxbdKNt1Gjn
TLSH
T17AF1EA9194C19769FF69B8B1A1C41E49B473889EFCD3AE4320B3E4789D1339355B3A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592205.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592205.TMP
Size 3KB
SHA256 c58f46f97e4fa1e16083515f47368faeb7b2a2b711df0a672a50adfec494d958
MD5 4ceb6126ab9352377ad56f22f1f8a154
SHA1 93e83bcd61fd14f2fcdd5470e9717acf604da55f
SHA512 eaac5cb10acf8200b59b79df4383041075da70373f7e75549a859915913307379c6fbfeab8278bdce07bee8ec0774cd8da16aaea779c304c45020b8363e7c9a7
TLSH
T1376163845684C1EFFF6BF8B0B5D62387F9354E9275D3ED51157CD478189AB505034850
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 383B
SHA256 55368549844f8812f548b5927db6b6a57f5038ef506428ab2a7ccef9427f7e69
MD5 d9837cea4b39f2875bd2d0e169c0ee20
SHA1 e3333bf26bdb98d6b4a866cfe5aef6b828212385
SHA512 d5e502cca340d21c0fafb97f0b74308629233672a9ef2336b36eadac1a8ea8d2423f2bd464b5879f9bfba9762aaa4059e5fed09c77f87709ea709ee83ab24617
TLSH
T1ABE0656859CDC2AFE1E410964124BF08DBB37B4FEB8CAE415B089891B182284B569171
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 0b9c27d0089ebdefaeb8e3d9aa33f023ca97e7c2b8b11128323e7e8d2aac20bd
MD5 0ad589af7be3d4b5754d3d2cf612c91a
SHA1 6b6c36348115de14fb337e42739bbb9db5075c2c
SHA512 e3f2f32b66518805ac2dc00f33da7805f38ccc727e1d256e2318909dd867439454cfee45811a9d2d6ff4d5997a6cce34e32d24d2541e055980ccf370d0a76e3d
SSDEEP 192:DrqJ0J0yEr/5sD/Miliw110ixYF+KhV5jdGichGc75/g2BGbme6zOx:DrqJ0J0yEr/5sD/Milx110ixYF+KhV51
TLSH
T16712C0F3C3E4862DD81166F05F287E1BCE2D096952683D1A85D8DF4BA3E24B2F15174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a12c22b2b5cf8957b19a72ec31ca20cbedd13349703b69dc4d889bbc3ceef89f
MD5 8ba82a2e219ac232d0d94c80236d19e2
SHA1 56d9de32730df3f7506b3819152fb715371cf050
SHA512 34be66cc36975b79f23ed3061ae662027ef434ffa44c6527eea966007d18b8df815289ea897795636fba647d4de044f80f4b97f78fe3b5340ac12b6231a222b6
SSDEEP 192:DrqJ0J0yEr/5sD/Maiw110ixYF+KhV5jdGichGc75qGg2BGbmket:DrqJ0J0yEr/5sD/Max110ixYF+KhV5jo
TLSH
T1BD12AEF3C3E4862DD81166F09F287E1BCE2D096852683D1685D8DF4BA3E6472E15174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7313877076a41a54b329c52c69953d0b1ed3f9d155e4eeb2c7d6c763f9c59128
MD5 6ab40a68468117b1fd3b0f6351e76579
SHA1 2a0133e590b6426a3b406e2ac049bddfd9fab16d
SHA512 43d863b03da98bb07eeb42ff8af346b3fc2215bc9e8ec3a3501eaae0e811bbbd1ccc501e03f12807135333c5010bdad4cee0519c8b3096dac761943102c7c5dc
TLSH
T151D02363270870B5666C2FC97075ECCFC7B600140401DDE410D2645D053545D4557241
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c280.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c280.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9477898f22ee473b77e185953e5966846dbe8e92b8c282026e8b38b21818ddb3
MD5 dc456c5cf953e1629efc6fe4e9d772d1
SHA1 af1199142fa0bc1fa45dcba4d3919fac11dc2821
SHA512 c9bdc6d39766a624575277441591df1d922b583c00884848327c0057a1a69ad1c2a4c994577d96f58d564c89b45aa1b636082e237e1761cbb44ed8d3516b76dd
SSDEEP 192:sxZhSooRalMPqM/fKrsGh5KZ7Dbf/f4CdpmheHW6+WNBhOdQ/Y3lX1yCIgrJ:sxZ0xPn/f2sGGP/f4iLHbv/a9
TLSH
T1A732D7126E24693B8CC7D61DBA25BF53E6F9403295D41E48F6FCDA1C08E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7a4e54df72d314176c1d85fa25f098cbc5e61e1d1df1dc531b2e054c2c8b4fb8
MD5 6455a196f685a9744a9d57bf833831f4
SHA1 34e2ef7182621f15d1468a09b357320542d85b66
SHA512 c4b1e1218cdf7d9f7350a2db44f3815557a1462223332a17b295220608deeb3956a22e2d8b01ab1c94ac7d179216577a47177162b7a5f8edfaee74fa99952137
SSDEEP 192:sxZhSD+coRalucBWqM/fKrsquhDKZO1Kbf/8ddpUhP7IhXh+hahLHW6+WNEhshOx:sxZT/mWn/f2s9t1k/G9Hbv0/Ei2BS
TLSH
T197620A525D24987B8DC7C619BE35BF52E7F900239C855E8CA6FCDA1C04EA2FD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 55a4f75a7e4786a99b47c621213444ee14d4b0aaaf2b8519e9cd5336ac8a9fb9
MD5 427f3f2961835b49e61fe25dac4443a0
SHA1 fcbf5bb7d2e18902ce5edb275754c7b548136f8e
SHA512 c7ba0789f7fd579916015e6d283a367f7f64e1550a50ff06193f20aac22a8cd5d15239643963f37f03420167815d22ba69bdbab1f54d7dec38f71bbd35903f3a
SSDEEP 192:sxZhSD+coRalucBWqM/fKrsqv+hDKZO1Kbf/8ddpUhP7IhXh+hahLHW6+WNEhshX:sxZT/mWn/f2sNt1k/G9Hbv0/Vi2BS
TLSH
T1F972F8525D24987B8DC7D619BE31BF52E7F900239C855E8CA6FCDA1C04EA6FD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7f879bb4ca5783559d1523358a3a3ddd04a780fdf8e023112f683feee40d6547
MD5 db07ce7fbe55aaef052b3c72edfe0fea
SHA1 83e558a19fe1cd118f17f9ddf9d7125ebe9ab0c5
SHA512 eb71e0ebdf8aebf53ee24ab70bc477ff0d6be850ce642ed355df11a9cd747f8022084a4f129fc6e3d7cb04be02f66c512bb88960e4f2022f4bd34bb6002fafb3
SSDEEP 768:CK30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72ZrolZMuO:CK30AbSWvS2l9u1jaLmLZ12S7O
TLSH
T1E3C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796644D4047FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 768B
SHA256 3bae7e3bf30530c1d776f55f25c08068d60c5c0b6c88f2a4a185915934255a4d
MD5 8acecd3d1077cce337d5ba661581173d
SHA1 8edbdd71da4a1b8fe134d1cccf6735f193b1f3dd
SHA512 a14051a0b788a11e57122ecfe0de5d495315967cc52985029bdfd4ba32b68328ce6f9a6d7ee95880c1ad309eb74807be796d19a4637efe82564ebd4932ec0af6
TLSH
T12801EBEB2C538E06FD250275603DB449A5B602DC53943B1FA2FDC1269CA2B90BE416A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 3KB
SHA256 9713d26991dc5d397064067d4ec304b141b2e117697896c38b5bdfeb4319f006
MD5 edcbdcc667dfad9543be8bd06e7ec2e0
SHA1 a8242b8e388437fee62f9aa8a5fa43e471eed96d
SHA512 3a4c59348e06ae390b8f463bb0202f314cc62c19ff56cf8c956175f15f1d6f7ff875a15ca8999d29f1d5f9d299ab0e2c3ffe14b92e65b647c70b83822f6c6ff0
TLSH
T1C151A74F4D4B6B62DDA822B518B50446333565DC17981F2BE4FD9A35BCC32652C6CF18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe586f4f.TMP
Size 768B
SHA256 1fc7ece8e5e4bd0c030941b0328db34f00aaac2402a9a6721aea91b203f15847
MD5 ad7be8b89c13acf824b1cbc83a5752f6
SHA1 096fbc667c067573b428bbe2b19106ecb75bd9b1
SHA512 8c621391e4a3b460ef873905d5aa5c358ee57229a2d61471380dcc5cd60efd2d4866309fd8d2af81ec1fe5c33d9edb935ead940ee08ffc9eb07dafd6da29cdef
TLSH
T11A0120DA01038B43FC0003709A3DA406216681486390774FA3EAA026CC53780BD83EB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a54f6f44-5155-40df-bbaf-5ba8cb84d61f\index-dir\the-real-index
Size 72B
SHA256 0f999ed9135c9c45420892f3e5de422b73c7d79a1ac1688c80e28d806117ae57
MD5 d266558284374cb560b71cfbac698f9b
SHA1 451c6c37273631c83e858bed56599e05ccb83807
SHA512 18751d66e1d10d78986844eba88200f8cd2a166d2d19b600fb767db402db88abdc71552e41435006c6cb460bdbf6ffff76a17842a74f71911fade8d74fb365ae
TLSH
T165A0023682C01801C822BBB075DE954B3351CE144A63530769A045AACD506475D5391C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a54f6f44-5155-40df-bbaf-5ba8cb84d61f\index-dir\the-real-index
Size 72B
SHA256 58114978efebc3d74dbf041d489dc160e57494a4094622bfc492dbf410405560
MD5 0c1f64e695be58441a48adc62ef87261
SHA1 f7a5c7261e6cf43ffcf347ffb1c35da1cc40f4cc
SHA512 97c6da73e00667fd321fbf5b51d5aefbc04bae40e98487f7a7cf3ef5f7aeca68aa051dd4e30832167688642d260761dec38d1fea3857bb47e76a252a0afad9c2
TLSH
T1E4A0041103C45435D01315F3155303C55341CC343103131741FD4344CCD04404F4131F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9ab916f758978babaf2570b7b66ffbbabbe385204e8d278db833c4da976556b9
MD5 718c584d444e33d34d589bd2b283e81b
SHA1 c7d6a14bc4cc08ef714106e17f0a8aea82e54171
SHA512 3f0de7ebb50519f996430db40230fc5163b493ebddc04902d083c87b78f9bc697de1abf7ffcb234133608854e0168d0575daa421a8fd491176cba5f89fe90920
TLSH
T16FE0C0F22DF71850FCAF83E5147088B141057898DA4CFC4F10AA77CBA4713113805C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d2ef5997301f50230c846989b409b0d2b1e2a8a8712cac3996e2f9c75348644f
MD5 0c4583197060821a161b62c34113c2d6
SHA1 11f5506652fb8eeeab38ac2489df9207d75e2097
SHA512 0a362c6fa03b78f301c28d54d12513e196febe34c2322d47c151e2decb0ea2929de0aae99901bb1f53938f2b4c9e818c3be6a37e2a4dd59f520194c136fd7103
TLSH
T185B011A8880A0082C0382B38888A88C8223A8A2C3BAA300280F8E020C023282800A002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e24d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e24d.TMP
Size 48B
SHA256 4835cf0881f441f3ad114edb9f07603989fd83381230cd01181048dc9f138eaf
MD5 fd6c85f2265b23c349791f75f536dc99
SHA1 afaede92ef0e19bf7c6a11388a8d3215bdb50b60
SHA512 4b9ad3ae9da4865531bc452cdb9ff1bba09d77c6fce5de18517e4d1a2f54298fe81182a557e21b7335802edaf5c35f05c67665b6bb7e9524c380686a3ef0dd96
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593bc7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593bc7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 58120bf8977f2fbe070a627b21ec10ab5e42dee7893e3efe23571468be3390fa
MD5 2ec18d39588cdc6f1154df9c347c0083
SHA1 fd485656a11ef89df716cb18c878b78e822ee899
SHA512 012a4e72924ab82dff9961b0fe3fde0220f77ad48d225a21660c69c8e8b5a224008a6e65422796c0429ae0cb3ea46484842437f1ffc294691756558d9b068d5c
SSDEEP 384:viFPZcIm+sNt8TUNTUlIlbTYpuBC6+oQf9iX5FX8E3OzXdJriuwTeUCbxon:6FHzMwgy2J+oQVapEdhiuwebx0
TLSH
T19DC23BF648D7883AE9AE9B47B73D3D028EBDC053B5846A50B7985A1CCD851FFD306821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0540b64a15a60db25dca0eb3efd8b249ed0d5856a8a4a6c53c36429de05d1cb
MD5 e6a2ac5b52c33507f29f375f905cc633
SHA1 8e606cf9f9c4c2c62dd2e97dff41f51d455c3a04
SHA512 95080048c201f0769ffaab5a27a18aeaf6ee775f39720fbb3691ad1dc9d6b49cd1c1bb9c0698506ed339656b488d416133b2420230e837142ad4ca9a077b2826
SSDEEP 192:LONU6AmwprQmiUyhChm6siX5FPjzorE3O+JiE4BU6:LONU6ipd86siX5FX8E3OrHU6
TLSH
T19402EA35BC786C7B8AF2AE45B44737139FA5116BEB942F94CAE81B2D01D769C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3a25878b6bb5eb424c09dfb797ca06bd97df68dbb687dbf6c02786343c197ed6
MD5 885e41df346f52674be17b35520c3329
SHA1 9929b344ffbe8129c459970b1f62189a16f87c65
SHA512 baad55e5476dd1f200884a6cd125e6f5ce889ab62d53393827f4c2dcd2bbe03149ca4366b2cf7d63165202aae7e983edda494c8f402083ce05f3fc45fd86142b
SSDEEP 384:oZcIEsNTbTYpuBCff9iX5FX8E3OzXdJr/uwTeUCbxon:WE92wVapEdh/uwebx0
TLSH
T109827D366D785C7A69E2E585F44B3613DFB98017E7C86F90C9ED6B2D02CA6D4130AC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e06d547485458ffba22df15e896bd9c2b6c9205a7568821073808324beee8cdc
MD5 6c046a8afb3d42aacc7eb87439503714
SHA1 fc2d0dd5d3efc09e812f3db484fd7c1cd35b8084
SHA512 00f69cd4132870e1c542fcfaa9246ec8b8be2acceb647d739a2bba1763cc9957371db7cc29cc3233cef3f2d2a8cbd6e21f19718aa25be9c6ac445410df46118f
SSDEEP 384:9ZcIhsNTiTYpuBJ1E29iX5FX8E3OzXdJrZuwTeUCbxon:lh22bEiapEdhZuwebx0
TLSH
T11A827E365D745C7A69E2E655F44B3603DFB58027E7C86F90C9ED6B2D02C96D4130AC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3fe5fba234dd5e0f3666b4a5f08632b05a0e6505b6578b85b469f5f0782e942d
MD5 ea3c4c34ec51a5fab80530d48867cad1
SHA1 b7440cff0c4c8244152fc413cc8dbf2fc82b170f
SHA512 0535b559741da023369b67f4b28f516a1dd5c72425ff7bacce2192157aaf20bc957e314f1f487c9ab57a46b647a3d9c758f26800b32792249e50ec21cd9133e2
SSDEEP 192:LONHm6Amwpp7yQmiUyhChmDVsiX5FPjzorE3OzXCSJrblREV/EYLU6:LONG6iptuCxsiX5FX8E3OzXdJr/uU6
TLSH
T1BD121C36B9786C7F5ED2A594B0873513DEA54127EB887F90DAEC1B2C01DF69C530A832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7196d8dd219e9b9775231b52cf54eae675a17e8e19dd69e8f122c40d7fd67107
MD5 92df2c45d710b22c012c512b036113b0
SHA1 6dd9bf5ddb71fd7302a5b122a354b34ad1884cc6
SHA512 14e30380ceb9431a2a32f841ee78ff223fef22e170d40342f56f31f8d52be7826e1e24aa8308c33b36486f0cdb998336b3147c7e4ff145b666667b0e4b7f719a
TLSH
T1D9E00210514040BAC03C1B3100435F21ADD1401411F102855732055C1CB37403330FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e1fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e1fe.TMP
Size 392B
SHA256 71ec6f121735090d325129665727d62f730ccb13d0c609044e6bd2ac535e0457
MD5 7911af850196a0632306d1be59b846b9
SHA1 160c7a385652032f2ec84097d99b436b48a7aede
SHA512 1e06d2e6cd79d0834d578ad56d46e3b2b9cce045247f1f40fd84b16a1f2461067bc63eae6eff1747720a45a6c3fe096902ebf8380d42b3546f7fb41438a99dc2
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 62e4e4430256da9b18eba40ff6ec9b6af5f7ef0ab9c10ebf81e748d0d6a4ccb9
MD5 605ef9465136d511fe64c51fb048d154
SHA1 698d776d1bf602cd23658fc499316ba30725e91a
SHA512 7d510a2a23cb89ed5b0968bea35ada0ce604812525ea914ca3c44803d385e1d8a55a76e261c0303e4f5f5e8d52abf4ffc796e8e935ef6c42fee9eaef574d1b9f
TLSH
T1CC413B5CA6EA1108B3B77E5AABF6787E487B7D731E0BD09D00110E4E0A27A40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Factua Invoici.rar

Path C:\Users\Admin\Downloads\Factua Invoici.rar
Size 1.1MB
SHA256 500dbf14e48927c04f473319cde28d9814d6dadfacdf9634342a743e503638d6
MD5 f5c2b9d8d919efd8fa82ecbcad0ea882
SHA1 325a29534a057538400f878dd13111ff0f1ce067
SHA512 1c35e097bfc7666fc10a741ee796fac972add5c73be127a8fa58471aba6b83254e115a81d60f3689576ec2f324d4583dd0c64d5d0148bc5f4acf054982877b87
SSDEEP 24576:izI0qhjNOp+zQqhFQBKBM5A65eM1S79Z+4RezksPxO8pUIfciGrvZW7p:izdoFzQqhyHAW29cTzksAQUliGzZ8p
TLSH
T1234533AAEFB61636233B00660757891C781DC242ECD3D6C6EEF962495F844B053AD6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download